Frameworks: coverage, settings and labels
A framework is a reading grid laid over the work you already do in the tool. Declaring a stack, fixing a CVE on time, justifying an exception, planning the exit of an end-of-life component, attesting an inventory review, importing a scan, keeping the supplier or incident register: each of these produces evidence, and each piece of evidence answers several texts at once.
The organization chooses the frameworks it follows: NIS2 (Directive (EU) 2022/2555 and Implementing Regulation 2024/2690), ISO/IEC 27001:2022, CIS Controls v8, ANSSI IT hygiene guide. NIS2 is a framework like the others: you follow it or not.
Three places
Section titled “Three places”| Where | What you do there |
|---|---|
| Settings › Frameworks (organization settings) | choose the frameworks followed, the entity’s NIS2 status, the owners, the covered projects, remediation deadlines, the management report |
Frameworks (Coverage page, address /referentiels) |
read, for each framework followed, its requirements, the tool’s measures that address them, the evidence screen and the status |
| Everyday screens | small labels (“NIS2 21.2.e · ISO 27001 A.8.8”) recall the requirements the screen serves |
As long as the organization follows no framework, none of this is shown: no label, no management report tab. The Coverage page only leads to the settings.
Choosing your frameworks
Section titled “Choosing your frameworks”The settings are in Workspace › Organizations, organization settings, Compliance group: the Frameworks, Owners and Management report pages (remediation deadlines are under Monitoring and remediation › Remediation deadlines, covered projects on the Coverage page). The former addresses /conformite/reglages and /conformite/activation lead to the matching page.
- Open Settings › Frameworks. The summary at the top leads to each section; See the coverage opens the Coverage page.
- Followed frameworks section: one switch per framework. Each shows the number and list of requirements mapped to the tool. Every toggle is saved at once (“Frameworks saved”).
- If NIS2 is followed, choose the entity status under NIS2: Essential entity, Important entity, Not in scope (voluntary tracking, as good practice) or I don’t know yet.
The NIS2 status is informative: it changes no calculation, it states on what basis the organization follows NIS2. Only the organization’s administrators and owner choose; other members read.
The other pages
Section titled “The other pages”- Owners: management, security officer, incident contact, named by the owner (see NIS2 settings).
- Covered projects: every project of the organization, each with its status, its workflows and Enable or Disable. Enabling a project opens its registers (deadlines, end of life, reviews, accepted risks); the first enabled project opens the organization’s (suppliers, incidents, report). This is the usual per-project activation (see Turning NIS2 on for a project), which applies to every framework followed.
- Organization workflows, Remediation deadlines, Report for management and the workflow catalogue: unchanged (see NIS2 settings).
What the choice changes, and what it does not
Section titled “What the choice changes, and what it does not”Following a framework changes neither the plan, nor permissions, nor the registers: it lays its reading grid over the same measures. An organization that follows only ISO 27001 keeps its registers (suppliers, incidents, reviews…) as long as its plan includes them and at least one project is covered: the access rule is the existing one (plan, then per-project activation).
The Coverage page
Section titled “The Coverage page”The Frameworks page (/referentiels) is the auditor’s view: you don’t work there, you read what the work has produced. It follows the organization of the active project; the former address /conformite leads there.
- Selector: one tab per framework followed (“NIS2”, “ISO 27001”…), when the organization follows several.
- Summary: the number of requirements per status and the number of covered projects (within your scope, out of those enabled in the organization). A sentence recalls that only requirements mapped to the tool are counted.
- Table: one row per requirement, with its numbers and title, the tool measures that address it (each with a coloured dot, a key figure and the See the evidence link to the screen where it is produced), then the requirement’s status.
- At the top of the page: Frameworks report (management) (Reports page) for those who can read it, and Settings.
If no project is covered yet, a banner says so and leads to the Covered projects section.
Statuses
Section titled “Statuses”| Status | Meaning |
|---|---|
| Covered | the measure runs and its evidence is up to date |
| Partial | it runs, but something is pending: deadline close, owner held by default, project not scanned… |
| To do | it has produced nothing yet (no covered project, empty register, no scan), or a dated obligation is overdue |
| Not covered by the tool | the module that produces it is not in the organization’s plan |
A requirement takes the most severe status of its measures. It is “not covered by the tool” only if none of its measures is produced; if just one is missing among others, it is partial.
Measures and their evidence
Section titled “Measures and their evidence”| Measure | Key figure | Where the evidence is produced |
|---|---|---|
| Designated owners | functions held by default | Settings › Owners |
| Stack-based monitoring | projects whose stack is monitored, freshness of national sources (CERT-FR, EUVD) | Stack |
| Remediation on time | on-time rate over 90 days | deadline planning |
| Exceptions and mitigations | accepted risks in force, awaiting approval, to review | Alerts, Exceptions view |
| Component end of life | out-of-support components among dated ones | End of life |
| Inventory and reviews | date of the last inventory review | Stack |
| Suppliers | register size, overdue assessments | supplier register |
| Incidents | register in use or not, date of the latest incident, overdue reports | incident register |
| Imported scans | date of the last scan, projects scanned within 90 days | Imports, connectors and scans |
| Coordinated disclosure | template provided (always “Partial”: the procedure is a document of the organization) | Download the template, on the row |
| Reports and evidence | date of the last report to management | Reports |
The figures are those of the management report: same calculations, same definitions. Project registers only count the covered projects you can view; incident details are reserved for owners and administrators (others see the status, not the figures).
Labels on screens
Section titled “Labels on screens”On the screens that produce evidence, small discreet labels recall the requirements of the frameworks followed: one label per framework (“NIS2 21.2.e, CIR 6.6”, “ISO 27001 A.8.8”). On hover or with the keyboard, a tooltip gives the title of each requirement.
| Screen | Measure |
|---|---|
| Stack page header | stack-based monitoring, inventory and reviews |
| End of life page | component end of life |
| Stack › Scans | imported scans |
| Reports, new report: remediation evidence, evidence pack | reports and evidence |
| Incidents page header | incidents |
| Suppliers page header | suppliers |
| Alerts, Exceptions view | exceptions and mitigations |
| Planning header | remediation on time (end of life on the End of life view) |
| Inventory review banner on the Stack page | inventory and reviews |
With no framework followed, or if the organization’s plan does not include frameworks (or that framework), no label appears.
The frameworks report (management)
Section titled “The frameworks report (management)”The report for management becomes the frameworks report (management): Reports page, Frameworks (management) tab (the former ?onglet=nis2 link leads there). Its title is “Frameworks report — management”; its references follow the frameworks followed: NIS2 articles (and Article 20 on management) only if NIS2 is followed, otherwise the requirements of the frameworks followed. Otherwise: summary, obligations mapping, one table per other framework followed, indicators and appendices (see The report for management). The tab only appears if the organization follows at least one framework.
Who can do what
Section titled “Who can do what”| Action | Who |
|---|---|
| Read the Coverage page and the Frameworks and Owners pages | any member of the organization, if the plan includes frameworks |
| Choose the frameworks and the NIS2 status | organization owners and administrators |
| Enable or disable a covered project | owners and administrators; for their project, anyone with “Project settings” |
| Name the owners | the owner |
| Read and generate the management report | owners, administrators, compliance owners |
Available depending on your plan
Section titled “Available depending on your plan”The Coverage page, the Settings › Frameworks page, labels and the management report need the Frameworks feature of the plan (Pro and Business). Each framework also has its own plan switch: a framework not included carries a padlock and the name of the plan that opens it, cannot be added, and is left out of coverage, labels and the report. If it was already followed, it stays selected and comes back with the plan. See also: Subscription › pages, views and items.
Frequently asked questions
Section titled “Frequently asked questions”I don’t see any label. The organization follows no framework, or its plan does not include frameworks. Open Settings › Frameworks.
Why does coordinated disclosure stay “Partial”? The tool provides the procedure template; the procedure itself is a document of your organization, to be completed and published outside the tool. The tool cannot know it is published.
All my requirements are “To do”. No project is covered yet, or you view no covered project. Enable at least one project in Covered projects.